An out‑of‑bounds write vulnerability exists in Lenovo BIOS firmware that, if triggered by a local privileged user, allows execution of code in System Management Mode. The flaw is classified as CWE‑787 and can grant an attacker BIOS‑level control, effectively providing unilateral system compromise over the affected machine.

The vulnerability impacts many Lenovo laptop models listed by Lenovo, including IdeaPad 5 and 3 series, Lenovo V14/V15, ThinkBook 16p and Plus series, Yoga 9 and Yoga Pro models, among others. No specific firmware version numbers are supplied; any BIOS prior to the release detailed in Lenovo's support advisory is considered vulnerable.

The CVSS score of 6.8 denotes moderate severity, while the EPSS score of less than 1% indicates a currently low likelihood of exploitation. The flaw requires local privileged access, implying that the attack vector is a physically present user with administrative rights or an exploit that achieves local privilege escalation. Once exploited, the attacker gains full control via System Management Mode, and the vulnerability is not listed in CISA’s KEV catalog.